Several years ago I presented the cyber insurance policy to the Board Risk Committee of a systemically important EU bank.

← Back to Blog

Several years ago I presented the cyber insurance policy to the Board Risk Committee of a systemically important EU bank. I went through the policy, coverage, limits and Premium. The CEO sat there diligently nodding, at the end of the presentation he asked one question, ‘how much insurance cover do I get for the price’. ‘You’ll get E100mn in cover’ was the answer.

He paused, ‘I’m a 1.4 Trn Euro asset bank, with annual profits of 50bn, what good is 100mn euro in possible cyber cover, come back to me when you can offer me 1 bn of guaranteed cover, at a reasonable price.’

Here in lies the problem for the insurance industry, as demonstrated by the recent cyber attack on United Health. What is the right amount of per program capacity when the frequency and severity of cyber attacks is increasing along with the coverage gap and 99% of organisations are SMEs?

Cyber is not a zero sum game between the insurer and the insured, far from it. The insured is the loser, through no fault of the insurer, but invariably the loser. The cyber insurance market needs to offer a balanced suite of risk transfer solutions that closes both the cyber coverage gap, and offers cyber insurance to cover the residual risk. Risk transfer products that will be affected by the introduction of U.S and EU cyber regulation.

@Thaddeus Dziekanowski Brian D. McCarthy

Veritas GRC Hiscox

#cybersecurity #cyberriskmanagement

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7204029060891471872